Multics Technical Bulletin                                MTB-664
Design Documentation

To:       Distribution

From:     Pozzo

Date:     07/02/84

Subject:  Design Documentation for the TCB


     The   Criteria   requires  design   documentation  that
     describes how  the TCB enforces the  security policy of
     the  system,  as  described  in the  DTLS.   It further
     requires  a  complete and  accurate description  of the
     interface   between  the   TCB  modules   and  the  TCB
     protection  mechanisms.   This  document  identifies an
     interim plan  towards satisfying this  requirement.  It
     further describes  what needs to be  done to completely
     fulfill the requirements set out by the Criteria.  This
     MTB, in addition to  informing the Multics community of
     its contents, serves as  formal notification to the DOD
     Security Evaluation Team, informing them of Honeywell's
     plans for  both an interim  and final plan  for Multics
     design documentation.

Comments should be sent to the author:

via Multics Mail:
   Pozzo.Multics on either MIT Multics or System M.

via US Mail:
   Maria M. Pozzo
   Honeywell Information Systems, inc.
   575 Tech Square
   Cambridge, Massachusetts 02139

via telephone:
   (HVN) 261-9364, or
   (617) 492-9364


Multics  project  internal  working  documentation.   Not  to  be
reproduced or distributed outside the Multics project without the
consent of the author or the author's management.

MTB-664                                Multics Technical Bulletin
                                             Design Documentation


The TCB  is that portion  of the system  (hardware, software, and
firmware),  whose  protection  mechanisms  enforces  the  sytem's
security  policy.  For  Multics, the software  that is considered
the TCB is ring zero, ring one and privileged applications.  (See
detailed list in Section 4).


Design documentation which satisfies the  Criteria for a level B2
system,  consists of  Multics PLMs (Program  Logic Manuals), SDNs
(System   Designers  Notebooks)   and  MTBs   (Multics  Technical
Bulletins)  for the  entire TCB.  Currently,  these documents for
many of the areas are outdated and some do not exist.

The  following  plan  will   provide  design  documentation  that
accurately describes the TCB as  it is currently implemented and,
coupled with  the Configuration Management  Strategy, will assure
that this doumentation is kept current.

It is intended to provide  accurate design documentation for each
area  of the  TCB.  The format  of this documentation  will be as

        *  An initial chapter which describes what the subsystem
           does, the classes of information it handles, how that
           information can  be  manipulated,  and an overview of
           how the subsystem interfaces  internally and with the
           rest of the TCB.

        *  A chapter specifying the security policy  enforced by
           the  subsystem  as  well  as  a  description  of  the
           security-relevant portion.

        *  Remaining chapters that detail the  internal  modules
           and interfaces of the subsystem.

In addition,  an overview of  the entire TCB will  be provided to
serve  as   an  introduction  to   this  entire  set   of  design


The  interim  plan  will  provide  the  first  two  chapters,  as
described above,  for MR11, as well  as the introductory overview
of  the entire  TCB.  The  following detailed  list describes the
area to  be covered and  the effort required  for completing both

Multics Technical Bulletin                                MTB-664
Design Documentation

the  interim  plan  and the  final  plan.  Note  that  the effort
required is in  terms of man-months, and that  the interim effort
is part of the final effort, not an addition to it.

Subsystem                                        Interim   Final
_________                                        _______   _____

Message Segments and Mailboxes                   0.25      1.00
Storage System (incl.  Salvagers)                0.50      2.50
System Initialization                            DONE      DONE
Programming Standards                            DONE      DONE
RCPRM                                            1.00      1.00
Security Control (Directory Control)             1.00      2.00
Volume Backup Dumper                             0.25      1.00
Hierarchy Backup Dumper                          0.25      1.50
Hardcore IO (IOI)                                0.25      1.00
System and User Control                          0.50      2.00
Interprocess Communication                       0.25      0.50
Traffic Controller                               0.50      3.00
IO Daemon - misc IO modules                      0.50      3.00
Reconfiguration                                  0.25      1.00
Name and Address Space Management                0.50      2.00
Run-Time Environment                             0.75      3.00
Fault and Interrupt Handling                     0.25      1.00
Logical Volume Management (MDC)                  0.50      2.00
System Administration                            0.50      2.00
On-line T&Ds                                     0.50      2.00
Ring-0 Auditing & Logging                        0.50      0.50
Overview of the TCB                              NA        NA
                                                 ______    ______

                                                 9.00      32.50